The Broken Promise of Tabletop Exercises: Why Security Leaders Are Demanding Change

As a founder in the cyber security incident response space, I spend a lot of time talking to CISOs, heads of security operations, and incident response leaders. Recently, I had two conversations that crystallized a problem I've been sensing for years: tabletop exercises, one of the most widely recommended practices in cybersecurity, are fundamentally broken in most organizations.

These weren't junior practitioners complaining about process. These were seasoned security leaders at major financial institutions—people who have built enterprise security programs, weathered real incidents, and understand the critical importance of preparedness. And they were both expressing the same frustration: tabletop exercises have become a compliance checkbox rather than a meaningful preparation tool.

The Manual Grind That Doesn't Scale

The first thing that struck me was how manual the entire process remains in 2025. We're living in an era where AI can analyze threats and correlate security events across global infrastructure—yet tabletop exercises are still being run with PowerPoint slides, dice games, and someone frantically taking notes.

One security leader described their process: a small team spends weeks creating scenarios, building slide decks, coordinating calendars, and then facilitating a 2-3 hour session for maybe 15-20 people. Then they write up findings, distribute them via email, and... that's it. Until the next exercise, which might be six months or a year away.

The math doesn't work. Most organizations should be running exercises monthly. Different scenarios, different teams, different threat vectors. But when each exercise requires 40-80 hours of preparation, that becomes impossible. Exercises happen sporadically, becoming annual events rather than ongoing practice.

This undermines their entire value. Incident response is a perishable skill. If your team only practices once or twice a year, they're not developing the instincts needed in a real crisis.

Generic Scenarios, Disengaged Teams

What happens when teams are stretched thin? They fall back on generic scenarios. One leader mentioned using the same basic templates year after year: ransomware scenario, data breach scenario, DDoS scenario. Sometimes they throw in dice rolls to add "unpredictability"—if you roll a six, the backup fails; if you roll a three, PR is unavailable.

Generic exercises fail to test what organizations actually need: their specific infrastructure, actual response procedures, unique business context. A ransomware scenario for healthcare doesn't translate to financial trading platforms. These scenarios don't evolve with the threat landscape either. If your template was created two years ago, you're training for yesterday's threats.

The result is what one CISO candidly called "boring exercises that are the same every year." When executives sit through the same scenario for the third time, they mentally check out. There's no learning, no challenge, no growth. It becomes security theater.

And "it's hard to get folks in the room." When exercises are infrequent, generic, and perceived as low-value, they drop to the bottom of everyone's priority list. The security team ends up begging for attendance, settling for whoever can make it rather than who should be there. This creates a vicious cycle: poorly attended exercises are less effective, which reinforces the perception they're not valuable, which makes them even harder to schedule.

The Runbook Paradox and Missing Results

One insight particularly troubled me: security teams often don't share their runbooks, even internally. The rationale? "It's confidential. It can't be accessed."

Think about this. You're asking teams to practice incident response procedures they can't actually review beforehand. Real incidents don't care about your documentation access controls. When ransomware is encrypting your production database, if that's the first time teams discover they need access to each other's runbooks, you're not responding—you're improvising.

The runbook gap means exercises can't truly test execution. They test theoretical knowledge, but not the actual procedures that would be followed. It's the difference between talking about fighting a fire and actually practicing with the equipment.

And what results are organizations getting? One CISO said it plainly: exercises are "painful to sit through" and "not getting the results."

Organizations spend significant time and money. They meet regulatory requirements. But what has actually improved? Often, the outputs are vague. "Lessons learned" documents get created with "action items." But six months later, the same gaps appear. The same communication breakdowns occur.

Why? The follow-up loop is broken. There's no systematic tracking of discoveries, fixes, and remaining vulnerabilities. No measurement of whether teams are getting better. No data showing if the investment pays off. When leadership asks "Is this working?" the honest answer is often "We don't really know."

Modernizing Tabletop Exercises

Both leaders mentioned wanting to modernize their programs. This makes sense when you look at how other aspects of security have evolved. We've automated threat detection and streamlined vulnerability management, yet tabletop exercises remain stubbornly manual.

The contrast between current reality and what's needed is stark:

Modern exercises need to incorporate current threat intelligence, reflect your organization's actual infrastructure and business model, and evolve as your environment changes. The scenario for Q1 shouldn't be identical to Q4 because your systems, threats, and business have all changed.

They need measurable improvement tracking: Are decisions being made faster? Are communication paths clearer? Are critical gaps being identified and fixed? And they need accessible preparation—teams should know what's expected before the exercise tests execution, not memory or access privileges.

The Role of AI: Helper, Not Hype

One leader specifically mentioned AI as a modernization tool. Given that AI is currently being applied to every problem, healthy skepticism is warranted. But for tabletop exercises, there are genuinely compelling use cases.

AI could generate realistic scenarios based on current threat intelligence and organizational context. It could adapt scenarios in real-time based on participant responses, creating more dynamic exercises. It could analyze team performance across multiple exercises to identify patterns and gaps. It could even facilitate routine scenarios without requiring human facilitation.

However, AI shouldn't replace human expertise and judgment. The goal is to amplify effectiveness, not automate away the security team. A small team should be able to run comprehensive, frequent exercises across the organization rather than being bottlenecked by manual processes.

The real promise isn't the technology itself—it's about removing the constraints that make good exercises impossible to scale.

It's about freeing security teams from the manual grind so they can focus on strategic aspects: designing meaningful scenarios, analyzing results, driving improvements, and building organizational resilience.

What Needs to Change

The conversations point to a clear conclusion: incremental improvements won't fix the broken status quo. Organizations need a fundamental rethinking.

Shift from events to practice

Annual exercises aren't sufficient. Teams need regular, varied practice to build the skills and coordination needed for effective response. This requires dramatically reducing the friction involved in creating and running exercises.

Make them relevant again

Generic scenarios from 2020 don't reflect 2025's threat landscape. Organizations need exercises that test their specific vulnerabilities, actual infrastructure, and real business risks.

Produce actionable insights

Vague documents in SharePoint aren't moving the needle. Organizations need clear metrics on response effectiveness, systematic tracking of gaps and improvements, and tight integration between exercise findings and remediation activities.

Break down silos

If teams can't review relevant procedures or coordinate across organizational boundaries, exercises test documentation gaps rather than response capability.

Get executive support beyond compliance

When exercises are viewed as audit requirements, they get minimum effort. When they're viewed as critical preparation for inevitable incidents, they get the resources needed to be effective.

The Path Forward

The security leaders I spoke with are identifying problems and seeking solutions. Their candor about these challenges is valuable for the broader community. These aren't fringe complaints—they're systematic problems affecting organizations across industries.

The good news? These problems are solvable. What's needed is recognition that the current approach isn't working and willingness to try something different.

Tabletop exercises were never supposed to be boring compliance activities. They're supposed to be valuable preparation that builds confidence, improves coordination, and reduces chaos when real incidents occur. The gap between that promise and current reality is wide, but it doesn't have to stay that way.

The question for security leaders isn't whether to improve tabletop exercises—it's how quickly they can make the changes needed to turn exercises from checkbox activities into genuine preparation tools. The next major incident won't wait for us to figure this out.

The insights shared in this post come from conversations with security leaders across the financial services industry. Their willingness to candidly discuss challenges helps move the entire industry forward.